Extracted

• • Target

    3328799cc7159d5313a6ef18c2167be55b53b5a390ce43f6910ca300f6830909

  • Size

    793KB

  • MD5

    6ce49a54158110b7e457631350b67604

  • SHA1

    5e23b0c628d0e6d86ffb660de63b36c4e6b1bd59

  • SHA256

    3328799cc7159d5313a6ef18c2167be55b53b5a390ce43f6910ca300f6830909

  • SHA512

    b8e85215c89d9424d15a3a51e6c075276a57009bf8a01c74a87267a1829e950aa2036e0e9b63bc95c8c73c74f1313c997765aba70c185e22cd10c4d8b8d32d11

  • SSDEEP

    12288:HTfq2mbKE2pb57I6iEn4KDVfzxIpz1ZNqrtB2i7koyTjAognGvb:Hk2t5s6iEnDANN+tB2i7koy4pnGD

  Score

  10^/10

  snakekeyloggercollectiondiscoverykeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2